<html>
<head><meta charset="utf-8"><title>(non-)constant time · wg-secure-code · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/index.html">wg-secure-code</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/(non-)constant.20time.html">(non-)constant time</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="171624427"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/%28non-%29constant%20time/near/171624427" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/(non-)constant.20time.html#171624427">(Jul 24 2019 at 17:14)</a>:</h4>
<p>A fun case study I just encountered...</p>



<a name="171624454"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/%28non-%29constant%20time/near/171624454" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/(non-)constant.20time.html#171624454">(Jul 24 2019 at 17:14)</a>:</h4>
<p>here is some C code <a href="https://godbolt.org/z/FzRm5h" target="_blank" title="https://godbolt.org/z/FzRm5h">https://godbolt.org/z/FzRm5h</a></p>



<a name="171624624"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/%28non-%29constant%20time/near/171624624" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/(non-)constant.20time.html#171624624">(Jul 24 2019 at 17:16)</a>:</h4>
<p>here is an attempt to translate that code into Rust <a href="https://godbolt.org/z/HCFmjy" target="_blank" title="https://godbolt.org/z/HCFmjy">https://godbolt.org/z/HCFmjy</a></p>



<a name="171624654"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/%28non-%29constant%20time/near/171624654" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/(non-)constant.20time.html#171624654">(Jul 24 2019 at 17:17)</a>:</h4>
<p>now with more jump instructions</p>



<a name="171624688"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/%28non-%29constant%20time/near/171624688" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/(non-)constant.20time.html#171624688">(Jul 24 2019 at 17:18)</a>:</h4>
<p>context <a href="https://twitter.com/real_or_random/status/1154011131066929152" target="_blank" title="https://twitter.com/real_or_random/status/1154011131066929152">https://twitter.com/real_or_random/status/1154011131066929152</a></p>
<div class="inline-preview-twitter"><div class="twitter-tweet"><a href="https://twitter.com/real_or_random/status/1154011131066929152" target="_blank"><img class="twitter-avatar" src="https://pbs.twimg.com/profile_images/925128264502439936/XcmMIk8k_normal.jpg"></a><p>Let's talk about code quality in cryptographic implementations. A lot of people in this thread say that the code in question is terrible but noone offers a convincing reason. Moreover, this is not constructive. <a href="https://t.co/KTQ11QkBsU" target="_blank" title="https://t.co/KTQ11QkBsU">https://twitter.com/isislovecruft/status/1153829390138171392</a></p><span>- Tim Ruffing (@real_or_random)</span></div></div>



<a name="171637152"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/%28non-%29constant%20time/near/171637152" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/(non-)constant.20time.html#171637152">(Jul 24 2019 at 19:50)</a>:</h4>
<p>Your Rust code is much different than the C code. Rewrite your Rust code using <code>usize</code> instead of <code>bool</code> and it may do the right thing.</p>



<a name="171637201"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/%28non-%29constant%20time/near/171637201" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/(non-)constant.20time.html#171637201">(Jul 24 2019 at 19:50)</a>:</h4>
<p>in particular, you're using short-circuiting <code>&amp;&amp;</code> and <code>||</code> in the Rust code, instead of non-short-circuiting <code>&amp;</code> and <code>|</code> in the C code.</p>



<a name="171637328"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/%28non-%29constant%20time/near/171637328" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/(non-)constant.20time.html#171637328">(Jul 24 2019 at 19:52)</a>:</h4>
<p>That said, I wouldn't use <code>&lt;</code>, <code>&gt;</code>, etc. in C either</p>



<a name="171637552"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/%28non-%29constant%20time/near/171637552" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/(non-)constant.20time.html#171637552">(Jul 24 2019 at 19:54)</a>:</h4>
<p>yeah, we already did that</p>



<a name="171637573"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/%28non-%29constant%20time/near/171637573" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/(non-)constant.20time.html#171637573">(Jul 24 2019 at 19:54)</a>:</h4>
<p>and it appears to be constant time</p>



<a name="171637630"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/%28non-%29constant%20time/near/171637630" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/(non-)constant.20time.html#171637630">(Jul 24 2019 at 19:55)</a>:</h4>
<p><a href="https://godbolt.org/z/NDovea" target="_blank" title="https://godbolt.org/z/NDovea">https://godbolt.org/z/NDovea</a></p>



<a name="171640689"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/%28non-%29constant%20time/near/171640689" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/(non-)constant.20time.html#171640689">(Jul 24 2019 at 20:31)</a>:</h4>
<p>Nice. Lucky that LLVM hasn't gotten around to optimizing that the wrong way yet.</p>



<a name="171640808"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/%28non-%29constant%20time/near/171640808" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/(non-)constant.20time.html#171640808">(Jul 24 2019 at 20:33)</a>:</h4>
<p>Interestingly, there are passes in LLVM that do optimize similar things a bad way, recognizing patterns for constant-time conditionals and converting them into non-constant-time conditionals, with the goal (I think) of having the auto-vectorizer convert them into SIMD conditionals that accidentally happen to be constant time.</p>



<a name="171640849"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/%28non-%29constant%20time/near/171640849" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/(non-)constant.20time.html#171640849">(Jul 24 2019 at 20:33)</a>:</h4>
<p>...but, when the auto-vectorization doesn't happen, it ends up using the non-constant-time scalar version of the code.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>